Billy had stepped back: to begin with.
There's no doubt whatsoever about that. His resignation party was six years ago.
Mrs. Scrooge had signed the goodbye card
and Mrs. Scrooge's signature was powerful within the Data Protection Commission.
Billy wasn't seen for years and probably moved to a sunny place for retirement.
But that night, after a long business conference
where she had to please big tech companies invested in Ireland,
Mrs. Scrooge had the feeling that she heard Billy's voice when she got back to her hotel room.
Mrs. Scrooge made herself a cup of tea and sat at the window,
hoping to come to other thoughts.
But even hours later,
Mrs. Scrooge still couldn't sleep, as she could not forget about Billy.
Suddenly, she heard his voice again:
"Scrooge, I was once in your position.
I wear a chain I forged in life.
I made it link by link and yard by yard,
holding me back from doing the right things."
Mrs. Scrooge told herself: "Bah! Humbug!"
But Billy's ghost went on and told Mrs. Scrooge:
"Tonight, you will dream of your past actions.
The ghosts of Christmas 2017,
2018 and 2021 will haunt you!"
Mrs. Scrooge told herself: "Bah! Humbug"
and fell asleep shortly after that.
When Mrs. Scrooge started dreaming, she remembered the ten meetings her office had
with Facebook around Christmas 2017 - debating how the US multinational
with headquarters in Ireland could bypass the GDPR.
Ultimately, they ended up with the idea
of just moving the consent clause into the terms and conditions.
Feeling uneasy about what she had done,
Mrs. Scrooge rolled in bed.
After finally dozing off, she dreamt of that pesky nonprofit that uncovered the agreed bypass
and even made the decision of the Data Protection Commission public.
She even dreamt that the nonprofit was making those letters
public, where Facebook referred to these ten meetings.
This would show how closely her office was working together with Facebook.
Later that night, Mrs. Scrooge had another nightmare.
She remembered that in spring 2018, her office was starting an EDPS subgroup on the issue.
In October 2018 her office made a proposal,
that tried to squeeze this GDPR bypass into European guidelines.
She could see the document in front of her very eyes.
Mrs. Scrooge woke up.
Would their intervention in interest of Facebook, be uncovered?!
Once she fell asleep again, she remembered the comments
that the other European data protection authorities had.
They were merciless.
"Contrary to everything we believe in. Sorry that it's true -
as well as previous Article 29 working party guidance.
Is it possible to provide social media accounts without tracking and profiling?
Yes. In fact, it is!"
"This seems to accept
monetization of personal data and circumventing the other legal basis.
We think that this interpretation undermines the system and spirit of the GDPR."
...another authority said:
"We will not want to comment with tracked changes at the stage - as a general direction
and scope of the paper should be agreed on first."
The other authority she never really liked even said:
"...but according to your logic, this can easily be resolved
by just specifying the processing of personal data in the contract.
Right?
This shows why the approach suggested, in our view,
is neither appropriate nor legally accurate."
She remembered that the other European authorities
had almost uncovered her plan to write Facebook's bypass into the EDPB guidelines
when constantly suggesting social networks as an example.
one authority noted:
"Furthermore, all the examples seem to relate to social networks."
Another authority similarly said:
"We suggest removing this example as this refers again to social media.
In addition, the monitoring of user behavior
cannot be held as reasonably necessary to perform the contract."
It was a total failure.
By the end of 2018, her office had to withdraw as the lead for the guidelines.
The remaining European authorities turned the paper around,
clearly stating that Facebook's bypass was not legal
and the circumvention of the law.
One authority even commented on her proposal:
"I disagree! This reduces the GDPR to a proforma instrument!"
She remembered that she had tried to delay the publication of the new guidelines.
But the other authorities went ahead with it anyways.
The next morning, Mrs. Scrooge woke up -
all sweaty and confused. Was Billy warning her?
She remembered her dreams and looked at the date.
It was Sunday, December 5th. The second advent.
She went to noyb.eu, checking for the advent reading of this nonprofit.
And there it was:
They had published the entire document where the Data Protection Commission
had tried to squeeze Facebook's bypass into the EDPB papers.
They even had people from all over Europe reading out the comments from other authorities.
It was absolutely devastating.
Especially, because she knew that it was all legal!
Mrs. Scrooge started to contemplate. Was she on the right track?
Her night started to remind her of that one Christmas story by Charles Dickens -
with the ghost of Christmas past...